Description
WBCE CMS version 1.6.3 and prior contains an authenticated remote code execution vulnerability that allows administrators to upload malicious modules. Attackers can craft a specially designed ZIP module with embedded PHP reverse shell code to gain remote system access when the module is installed.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| WBCE | WBCE CMS | ≤ 1.6.3 | — |
References
- ExploitDB-52132 exploit
- WBCE CMS Homepage product
- WBCE CMS GitHub Repository product
- YouTube Demonstration product
- Swammers8 GitHub Repository technical-description
- VulnCheck Advisory: WBCE CMS <= 1.6.3 Authenticated Remote Code Execution via Module Upload third-party-advisory